The network device must display an explicit logout message to administrators indicating the reliable termination of authenticated communications sessions.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-202086 | SRG-APP-000297-NDM-000281 | SV-202086r961227_rule | CCI-002364 | medium |
| Description | ||||
| If an explicit logout message is not displayed and the administrator does not expect to see one, the administrator may inadvertently leave a management session un-terminated. The session may remain open and be exploited by an attacker; this is referred to as a zombie session. Administrators need to be aware of whether or not the session has been terminated. A prompt for new logon is an acceptable indication of previous session termination. If the device takes the user back to the logon page or prompt after selecting the logoff button, it is considered an explicit logout message. In the case of terminal sessions (such as SSH), an explicit logoff message is displayed by the client application. Usually this is a message such as "connect closed by remote host" displayed by the client. For a terminal connected to the console port of a network device, either a logoff message is displayed or the device takes the user back to the logon prompt. | ||||
| STIG | Date | |||
| Network Device Management Security Requirements Guide | 2025-09-10 | |||
Related Frameworks
1 mapping across 2 frameworks
Related Frameworks
NIST 800-530 mappings
No source states a mapping between these directly.
Also reachable in 2 hops (3) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)V5R4intersects(normalised)
- DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)DISA STIG Benchmark (XCCDF)V1R7our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)1intersects(normalised)DISA STIG Benchmark (XCCDF)V1R7intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V5R4intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V5R4intersects(normalised)
- DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)DISA STIG Benchmark (XCCDF)V1R7our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)1intersects(normalised)DISA STIG Benchmark (XCCDF)V1R7intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
CCI1 mapping
CCI-002364
1.00
- DISA STIG Benchmark (XCCDF)V5R4intersects(normalised)
Details
Check Text (C-202086r961227_chk)
This requirement may be verified by demonstration. If an explicit logoff message is not displayed, or provides clear evidence that the session has been terminated, this is a finding.
Fix Text (F-2213r381861_fix)
Configure the network device to display an explicit logoff message to administrators indicating the reliable termination of authenticated communications sessions. This may be a capability the device is inherently capable of.